Skip to Content

New J2Commerce 6.6.5 is out. Here is everything in the release.

See What’s New

Search

Start For Free
Account
Enter the email address on your account.
Forgot your username?
Enter your password.
Forgot your password?

Or continue with

Support Ends October 19, 2026

J2Store 3

J2Store 3 support ends on October 19, 2026. After that date it receives no updates, including security fixes. Download the final release, then move your store to J2Commerce 6.

Plan Your Migration

Support Status

Where each version stands today.

Check the version your store runs today, then pick the path that keeps it current.

  • J2Store 3

    After October 19, 2026, J2Store 3 receives no further updates, including security fixes.

    End of Life October 19, 2026

  • J2Commerce 6

    New features and new extensions arrive here first, on Joomla 6.

    Active Development

    Download J2Commerce 6

Migrate to J2Commerce 6

Move your store to J2Commerce 6 with its history intact.

The J2Commerce 6 Migrator carries your catalog, orders, customers and images across.

  • J2Commerce 6 Migrator

    Migration J2Commerce

    Move an older J2Store or J2Commerce store to J2Commerce 6, with products, orders, customers, coupons and images landing in place.

    Free

Changelog

Latest J2Store 3 releases.

The last J2Store 3 updates before its end of life on October 19, 2026.

Changed

  • Removed App Store
  • Updated links

Fixed

  • Restored the product form in the front-end article editor
  • Fixed cannot add products when editing orders in the backend

Changed

  • Improved CSRF token handling for new module files and update warnings in help.php and the installer script

Fixed

  • Fix user delegated tasks fail unauthorized
  • Cannot remove order items in the cart
  • Force reload to avoid invalid token on registration
  • Fix token handling in cart item removal link for mod_j2store_cart
  • Fix typos in installer script

Fixed

  • CVE-2026-78081 Missing CSRF protection on cart, checkout and myprofile controllers
  • CVE-2026-81567 Blind SQL injection in the storefront product list
  • CVE-2026-81568 Arbitrary file read via `task=download`
  • CVE-2026-82189 Any order can be marked Failed by anyone
  • CVE-2026-82190 Predictable/forgeable order access token
  • CVE-2026-82191 Unescaped request data reflected into PayPal notify redirect

Fixed

  • CVE-2026-77999 Unauthenticated PayPal callback forgery
  • CVE-2026-78000 Reflected XSS via filter_tag, pricefrom and priceto
  • CVE-2026-78064 Anonymous cart-record tampering through inherited FOF tasks
  • CVE-2026-78065 Guest address readable by any registered user
  • CVE-2026-78069 Apps delegation chain currently shielded by accident

Launch with more today. Add what you grow into tomorrow.

Start For Free Get the Migrator

Download J2Commerce 6 and start selling today.